And for that matter, since tty->read_cnt is 0 above, your original question as to how that code path was taken to begin with is also valid.